Advanced protection against intrusions and threats

Architectures

Advanced protection: monitor, detect, respond

What advanced protection does

We monitor your servers, workstations and cloud services, detect intrusions and can isolate a compromised workstation or server. The tool relies on a SIEM (collection and analysis of event logs) and on extended detection and response (XDR).

It complements proactive protection: the latter blocks upstream, while this one sees and reacts when a threat is already inside.

Who is it for?

SMEs and mid-sized companies that host servers or cloud services and want to know what is happening on them. Our solution is designed to keep your digital assets secure and strengthen your organisation’s cybersecurity posture.

Servers, workstations and cloud under watch

What the tool monitors and does

Configuration assessment

Our solution monitors system and application configuration settings to make sure they comply with your security policies and standards. Agents run periodic scans to detect incorrect configurations or security flaws.

Malware detection

The tool detects malicious activity and indicators of compromise resulting from a malware infection or a cyberattack. Predefined rules, which we adapt to your environment, spot suspicious activity and anomalies.

File integrity

Our tool monitors the file system and identifies changes to the content, permissions and ownership of the files you need to track. File integrity monitoring also helps meet several compliance frameworks (PCI DSS, NIST…).

Threat hunting

The tool gives full visibility of the workstations, servers and infrastructure being monitored. It stores, indexes and lets you query logs, making it easier to investigate threats that have bypassed the first security barriers.

Compliance support

Our solution provides the security controls needed to meet the standards and regulations of your sector: file integrity monitoring, configuration assessment, vulnerability detection, system inventory… These controls support compliance, but do not amount to certification.

Incident response

The tool provides predefined active responses to act against ongoing threats. They are triggered when certain criteria are met, for example to cut a workstation’s or server’s network access and isolate it from the source of the threat.

Log analysis

Agents collect operating system and application logs and transfer them securely to the dedicated server, where they are analysed according to specific rules.

Inventory and IT hygiene

Our tool keeps an up-to-date inventory of all monitored workstations and servers, for better visibility of your IT estate and good IT hygiene.

Cloud workload protection

Our tool monitors and protects workloads in the cloud and on premises, integrating with platforms such as AWS, Microsoft Azure, Google Cloud, Microsoft 365 and GitHub.

The components

Server

The server manages the agents, configures them and updates them remotely. It analyses the data received from the agents using decoders and rules, and draws on threat intelligence to look for indicators of compromise.

Dashboard

A flexible, intuitive web interface to explore, analyse and visualise data. The dashboard is also used to manage the tool’s configuration and monitor its status.

Agent

The agent runs on the workstations and servers to be monitored. It acts preventively, takes part in detection and can provide a response.

Why choose our solution?

Our tool offers a full range of security functions: configuration assessment, malware detection, file integrity monitoring, threat hunting, log analysis, incident response, compliance support, IT hygiene, and more.

Its capabilities are tailored to your organisation’s needs: we customise configuration checks, detection rules and incident responses.

It integrates with the major cloud platforms, for continuous visibility and protection of your services, virtual machines and activity in these environments.

Finally, it makes it easier to produce reports and dashboards to meet frameworks such as the GDPR, NIST, TSC or HIPAA.

In conclusion

Advanced protection monitors and defends your systems against intrusions and threats. Whether you are a small or large company, you benefit from a complete, highly adaptable solution with advanced features, to respond effectively to today’s IT security challenges.

See what is happening on your servers

Describe your servers, workstations and cloud services. We will call you back to propose the right monitoring.